Towards the application of recommender systems to secure coding

• Main Authors: Fitzroy D. Nembhard, Marco M. Carvalho, Thomas C. Eskridge
• Format: Article
• Language: English
• Published: SpringerOpen 2019-06-01
• Series: EURASIP Journal on Information Security
• Subjects: Secure coding; Vulnerability detection; Code analysis; Data mining; Secure systems; Intellisense
• Online Access: http://link.springer.com/article/10.1186/s13635-019-0092-4

Abstract Secure coding is crucial for the design of secure and efficient software and computing systems. However, many programmers avoid secure coding practices for a variety of reasons. Some of these reasons are lack of knowledge of secure coding standards, negligence, and poor performance of and usability issues with existing code analysis tools. Therefore, it is essential to create tools that address these issues and concerns. This article features the proposal, development, and evaluation of a recommender system that uses text mining techniques, coupled with IntelliSense technology, to recommend fixes for potential vulnerabilities in program code. The resulting system mines a large code base of over 1.6 million Java files using the MapReduce methodology, creating a knowledge base for a recommender system that provides fixes for taint-style vulnerabilities. Formative testing and a usability study determined that surveyed participants strongly believed that a recommender system would help programmers write more secure code.